HackingOtherStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDFinancial accountMediumContained

Merritt Park Holdings LLC

bd_6e04cc3e3176d336 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 20, 2020

To disclose

—

Affected

1state residents only

Linked

2 filings

Confidence

66%

Full breach record for Merritt Park Holdings LLC →

Merritt Park Holdings LLC notified the NH Attorney General of unauthorized access to a property manager's Entrata account from June 29, 2019, to February 8, 2020. The attacker used the account to send emails and modify resident rent information. While specific data access was not confirmed, personal information including names, addresses, dates of birth, SSNs, driver's license numbers, and financial account information may have been exposed. One New Hampshire resident was affected. The company engaged forensic experts, reported to law enforcement, implemented MFA, and offered 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

Jun 29, 2019

Begins

Apr 20, 2020

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Indiana State AGbd_9dbc9ec9405c29da2020-04-16 · +4dVerified

Name: Merritt Park Holdings LLC
norm: merritt park holdings

Name: Merritt Park Holdings LLC
norm: merritt park
Industry: Otherllm

Discovered: —
Breach occurred: Jun 29, 2019 – Feb 8, 2020
Materiality determined: —
Notification sent: Apr 16, 2020
Affected individuals: 1state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified Office of the New Hampshire Attorney General
Third party: via Entrata
Initial access: valid_credentials

During the incident: Began an investigation
Engaged third-party forensic experts
Worked with Entrata to determine impact
Reported this incident to law enforcement
Implemented additional safeguards within Entrata, including the use of multi-factor authentication
Providing access to credit monitoring services for twelve (12) months, through Kroll
Providing impacted individuals with guidance on how to better protect against identity theft and fraud
Changes made: Implemented additional safeguards within Entrata, including the use of multi-factor authentication
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Indiana State AGApr 16 · first

New Hampshire State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/merritt-park-holdings-20200420.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 20, 2020
Raw hash: ae42f5147b4bba89bd3956009b60cba99f1f2cdf2415c68557228338341d0e10

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMerritt Park Holdings LLC

Victim entityMerritt Park Holdings LLC

IncidentUnauthorized Access

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov